Support / Voice / Firewall / Cable modems

ISP cable, DSL, and fiber gateways.

ISP-supplied gateways ship with SIP ALG enabled and almost never expose a toggle to disable it. The reliable fix is to put the gateway in bridge mode (a.k.a. passthrough, IP passthrough, transparent bridging) and run your own router behind it.

Why ISP gateways are the hardest to fix

  • The "VoIP optimization" or "QoS" features the ISP markets are usually SIP ALG by another name.
  • Customer admin accounts often hide the ALG toggle.
  • Some ISPs reset configuration changes during overnight firmware refreshes.
  • Even when SIP ALG can be disabled, default UDP NAT timeouts on these gateways are aggressively short.

Bridge mode is the canonical workaround — the ISP gateway becomes a dumb modem and your own router (covered in the other firewall guides) handles NAT, ALG, and timeouts on terms you control.

Comcast / Xfinity Business Gateway

Models: XB6, XB7, XB8, Cisco DPC3941B, Technicolor TG3482G.

  1. Sign in at http://10.0.0.1 with admin credentials (default: cusadmin / highspeed on older firmware; check the sticker for newer).
  2. Open Gateway → At a Glance.
  3. Find Bridge Mode and click Enable. The gateway reboots; Wi-Fi and the LAN switch are disabled — your downstream router handles those.

If you can't enable bridge mode (some Comcast Business Voice plans block it), call Comcast Business support and request "transparent bridge mode" or escalate to disable SIP ALG.

Spectrum / Charter

Spectrum gateways (Sagemcom, Askey, Hitron) usually don't expose a customer-controlled bridge toggle. Two paths:

  • Call Spectrum and request the modem be placed in bridge mode at the provisioning level. They can flip it remotely on most accounts.
  • Buy your own DOCSIS modem (Motorola, Netgear, Arris) — Spectrum supports BYO equipment on most service tiers. Pair with your own router for full SIP control.

AT&T BGW210, BGW320 (Fiber)

  1. Sign in to http://192.168.1.254.
  2. Open Firewall → IP Passthrough.
  3. Set Allocation Mode to Passthrough.
  4. Set Default Server Internal Address to your downstream router's MAC or fixed LAN IP.
  5. Save and reboot.

The BGW gateway can't be fully bridged (it must terminate the AT&T VLAN), but IP Passthrough hands the public IP to your downstream router, which then handles NAT/SIP.

Verizon Fios (G1100, G3100)

Fios routers don't have a SIP ALG toggle. Bridge them via the Verizon admin UI:

  1. Sign in to http://192.168.1.1.
  2. Open Advanced → Network Settings → Network Connections.
  3. Disable the routing function and set the gateway to bridge the ONT directly to your downstream router via Ethernet.

For Fios setups using coax (MoCA) instead of Ethernet, contact Verizon to switch the ONT to Ethernet handoff before bridging — necessary for downstream routing to work cleanly.

Cox Business

Cox calls SIP ALG "VoIP optimization." Sign in to the Cox Business gateway admin UI and untick the relevant checkbox under Advanced → SIP. If your Cox plan includes hosted voice, Cox often refuses to disable ALG on the same gateway — request bridge mode instead.

CenturyLink / Quantum Fiber

CenturyLink gateways (C3000A, C4000) expose a transparent bridging mode under Advanced Setup → WAN Settings → Transparent Bridging. Enable it; the gateway becomes a layer-2 modem and your downstream router handles NAT and SIP traversal.

If bridge mode isn't an option

Some service plans (especially ISP-bundled hosted voice) block bridge mode. Two workarounds:

  • Double NAT. Plug your own router into the ISP gateway's LAN. Disable ALG on your router (per the vendor guides). The ISP gateway's ALG still misbehaves on traffic that originates there, but downstream-only SIP traffic should work.
  • VoiceTel SDN appliance. The SDN appliance tunnels SIP and RTP over an encrypted overlay back to VoiceTel — the ISP gateway can't inspect or modify the SIP that's wrapped inside the tunnel. Reliable fix when you have no admin access to the ISP equipment.